diff --git a/test/README.md b/test/README.md
index 929108f..2586f96 100644
--- a/test/README.md
+++ b/test/README.md
@@ -74,6 +74,22 @@ script or log.
 | `ncopy/` | varies | NCOPY experiments. |
 | `filer/` | varies | FILER-related notes/experiments. |
 
+## Host-side NSS/OES metadata readback
+
+After running trustee, rights, flag, creator, or quota-related DOS tests against a
+MARS-NWE `SYS:` tree, collect the canonical NSS/OES xattrs from the host with:
+
+```sh
+sh dosutils/test/cmnwmeta.sh /path/to/SYS /path/to/nwfs_xattr_dump > meta.log
+```
+
+The collector decodes `netware.metadata`, `netware.quota`, and
+`netware.userquota` from the files and directories changed by the DOS tests.
+This is the expected verification layer for the NSS migration: DOS tools or
+NCPFS perform the mutation, and `nwfs_xattr_dump` proves that the resulting
+state landed in the OES-compatible `netware.*` metadata rather than only in the
+legacy mars-nwe side stores.
+
 ## Packaging
 
 Most test directories have a matching `*ZIP.BAT` that packages the result tree
diff --git a/test/cmnwmeta.sh b/test/cmnwmeta.sh
new file mode 100755
index 0000000..e298a32
--- /dev/null
+++ b/test/cmnwmeta.sh
@@ -0,0 +1,52 @@
+#!/bin/sh
+# Collect decoded OES/NSS netware.* metadata from a host-side SYS tree.
+#
+# Use after running DOS-side tests such as grant/rights/flag/quota tests:
+#   sh dosutils/test/cmnwmeta.sh /path/to/SYS /path/to/nwfs_xattr_dump > meta.log
+#
+# The dumper reads the mars-nwe userspace xattr mapping, so on Linux it looks
+# at user.netware.metadata, user.netware.quota and user.netware.userquota.
+
+set -eu
+
+SYSROOT=${1:-}
+DUMPER=${2:-}
+
+if [ -z "$SYSROOT" ] || [ -z "$DUMPER" ]; then
+    echo "usage: $0 SYSROOT nwfs_xattr_dump [path ...]" >&2
+    exit 2
+fi
+if [ ! -d "$SYSROOT" ]; then
+    echo "cmnwmeta: SYSROOT is not a directory: $SYSROOT" >&2
+    exit 2
+fi
+if [ ! -x "$DUMPER" ]; then
+    echo "cmnwmeta: nwfs_xattr_dump is not executable: $DUMPER" >&2
+    exit 2
+fi
+
+shift 2
+
+if [ "$#" -gt 0 ]; then
+    exec "$DUMPER" "$@"
+fi
+
+# Known test roots from dosutils/test/*.BAT.  Missing roots are ignored so this
+# script can be run after any subset of tests.
+for rel in \
+    CIXTEST CIXCMP \
+    FLGTEST FLGCMP \
+    FDGTEST FDGCMP \
+    GRNTEST GRNTCMP \
+    RGHTEST RGHTCMP \
+    RMVTEST RMVCMP \
+    RVKTEST RVKCMP \
+    NDIRTST NDIRCMP \
+    TFILE \
+    NCPTST NCPCMP \
+    RUTEST RUTCMP
+ do
+    if [ -e "$SYSROOT/$rel" ]; then
+        find "$SYSROOT/$rel" -xdev \( -type f -o -type d \) -print
+    fi
+ done | sort | xargs -r "$DUMPER"